From 2b758d876a199fa861bdb18e11e3367270842680 Mon Sep 17 00:00:00 2001 From: ljstella Date: Wed, 9 Apr 2025 12:18:36 -0500 Subject: [PATCH 1/6] Updating issue templates with types --- .github/ISSUE_TEMPLATE/bug_report.md | 1 + .github/ISSUE_TEMPLATE/feature_request.md | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 1ffd32323f..c3b2012a10 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -4,6 +4,7 @@ about: Create a report to help us improve title: "[BUG]" labels: bug assignees: '' +type: "Bug" --- diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 11fc491ef1..1d2e5c6cc7 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -4,6 +4,7 @@ about: Suggest an idea for this project title: '' labels: enhancement assignees: '' +type: "Feature" --- From c79c1f63ba7e5b40993ca7b6ac7b988bbc3e0353 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 9 Apr 2025 16:31:51 -0700 Subject: [PATCH 2/6] updating version --- contentctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.yml b/contentctl.yml index ed79d50b12..b64f0dd2b8 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.2.0 + version: 5.3.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 8020e90e6d6485079fa2b0261fa6aef87accb317 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 10 Apr 2025 11:05:36 -0500 Subject: [PATCH 3/6] Add output fields, tighten up outputs --- .../endpoint/windows_runmru_command_execution.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index f71133e44c..d930abc702 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -16,13 +16,7 @@ description: The following analytic detects modifications to the Windows RunMRU If confirmed malicious, this could indicate an attacker using indirect command execution techniques for defense evasion or persistence. The detection excludes MRUList value changes to focus on actual command entries. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" - NOT Registry.registry_key_name="*\\MRUList" by Registry.action Registry.dest Registry.process_guid - Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name - Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type - Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,6 +75,8 @@ tags: - Splunk Cloud security_domain: endpoint cve: [] + atomic_guid: + - de323a93-2f18-4bd5-ba60-d6fca6aeff76 tests: - name: True Positive Test attack_data: From 23f0df3e96c2bf0aeeac961e0e5403fcf3359572 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 10 Apr 2025 11:07:16 -0500 Subject: [PATCH 4/6] Date & Version bump --- detections/endpoint/windows_runmru_command_execution.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index d930abc702..ce8652eb11 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -1,7 +1,7 @@ name: Windows RunMRU Command Execution id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a -version: 4 -date: '2025-02-17' +version: 5 +date: '2025-04-10' author: Nasreddine Bencherchali, Michael Haag, Splunk data_source: - Sysmon EventID 12 From c733afbb0f3f9f623cfcefa1ae98c811422c8c55 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 10 Apr 2025 11:09:33 -0500 Subject: [PATCH 5/6] Update PR template for contentctl v5 lookup handling --- .github/pull_request_template.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index f40ca9387b..8d43d450cd 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -15,4 +15,4 @@ _What does this PR have in it? Screenshots are worth 1000 words 😄_ - If you're submitting a PR from a fork, ensuring the box to allow updates from maintainers is checked will help speed up the process of getting it merged. - Checking the output of the `build` CI job when it fails will likely show an error about what is failing. You may have a very descriptive error of the specific field(s) in the specific file(s) that is causing an issue. In some cases, its also possible there is an issue with the YAML. Many of these can be caught with the pre-commit hooks if you set them up. These errors will be less descriptive as to what exactly is wrong, but will give you a column and row position in a specific file where the YAML processing breaks. If you're having trouble with this, feel free to add a comment to your PR tagging one of the maintainers and we'll be happy to help troubleshoot it. -- Updates to existing lookup files can be tricky, because of how Splunk handles application updates and the differences between existing lookup files being updated vs new lookups. You can read more [here](https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Admin/PrivateApps#Manage_lookups_in_Splunk_Cloud_Platform) but the short version is that any changes to lookup files need to bump the datestamp in the lookup CSV filename, and the reference to it in the YAML needs to be updated. \ No newline at end of file +- Updates to existing lookup files can be tricky, because of how Splunk handles application updates and the differences between existing lookup files being updated vs new lookups. You can read more [here](https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Admin/PrivateApps#Manage_lookups_in_Splunk_Cloud_Platform) but the short version is that any changes to lookup files need to bump the the date and version in the associated YAML file. \ No newline at end of file From ce3755b4d8520c75e1ebc361ac25c5174c2c388f Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 10 Apr 2025 11:56:02 -0500 Subject: [PATCH 6/6] Add registry_path --- detections/endpoint/windows_runmru_command_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index ce8652eb11..1f8c6fc811 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -16,7 +16,7 @@ description: The following analytic detects modifications to the Windows RunMRU If confirmed malicious, this could indicate an attacker using indirect command execution techniques for defense evasion or persistence. The detection excludes MRUList value changes to focus on actual command entries. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search,